admin
ef7d94eb2e
Mirrors profiles/n100.profile with one deliberate difference: the loader default stays at the stock signed shim chain. mkimage exists to work around the N100's AMI firmware GRUB relocation defect, not as a Felhom requirement, and it costs Secure Boot. HP business firmware should take shim - so try it first and carry mkimage as the fallback. Ships the match-nothing disk filter, so built as-is it IS the hp-safety pre-flight ISO. Arming instructions point at an uncommitted working profile, per the n100-demo precedent.
44 lines
2.7 KiB
Plaintext
44 lines
2.7 KiB
Plaintext
# Felhom ISO build profile — HP mini (second pilot board, 2026-07-21).
|
|
#
|
|
# Same shape as profiles/n100.profile, with ONE deliberate difference: the loader default is left at
|
|
# the stock signed `shim` chain rather than `mkimage`.
|
|
#
|
|
# WHY: `mkimage` exists to work around the N100's early AMI (AN3PLUS-class) firmware, which cannot
|
|
# USB-boot the ISO's stock signed GRUB (VALIDATION-n100-baremetal F1, `relocation 0x0`). That is a
|
|
# defect of that firmware, not a Felhom requirement. HP business-desktop firmware is Secure-Boot
|
|
# capable and generally standards-compliant, so `shim` is the one to try FIRST — it keeps Secure
|
|
# Boot working, which `mkimage` cannot (it is unsigned; an SB-enforcing board refuses it outright
|
|
# with "Access Denied" — proven, RUNBOOK-B leg 3).
|
|
#
|
|
# The board's firmware is nevertheless UNKNOWN until it is in hand, so BOTH loader variants are
|
|
# built from this one profile — the AMI lesson is to carry both rather than make one trip:
|
|
# bash scripts/iso/build-felhom-iso.sh … --profile scripts/iso/profiles/hp.profile --pairing --loader shim
|
|
# bash scripts/iso/build-felhom-iso.sh … --profile scripts/iso/profiles/hp.profile --pairing --loader mkimage
|
|
#
|
|
# ⚠ THIS PROFILE IS DELIBERATELY INERT — it ships the MATCH-NOTHING disk filter as a safety default,
|
|
# exactly like n100.profile. Built as-is it is the `hp-safety` pre-flight ISO: it boots the full
|
|
# installer path and then ABORTS having touched no disk (spike S5c). That is the point — the first
|
|
# thing a brand-new board ever runs should be provably harmless, and it proves the loader + Secure
|
|
# Boot setting before anything destructive exists on a USB stick.
|
|
#
|
|
# To ARM it for the real install, do NOT edit this file: copy it to an UNCOMMITTED working profile
|
|
# (the n100-demo.profile precedent — a real serial and any baked key must never be committed),
|
|
# replace the serial below with the target SSD's real ID_SERIAL_SHORT harvested from the board
|
|
# pre-wipe (`lsblk -o NAME,SERIAL` / `udevadm info`), and rebuild. Confirm the serial is the
|
|
# INTERNAL SSD and not an attached backup drive — that check is what protected the N100's external
|
|
# HDD on the rehearsal run.
|
|
|
|
FELHOM_FQDN="felhom-host.local"
|
|
|
|
# Loader: stock signed shim (Secure Boot stays ON). Override per-build with `--loader mkimage` if the
|
|
# board turns out to have the N100's GRUB relocation defect — and set Secure Boot OFF if you do.
|
|
|
|
FELHOM_DISK_SETUP='[disk-setup]
|
|
filesystem = "ext4"
|
|
filter-match = "all"
|
|
filter.ID_SERIAL_SHORT = "REPLACE-WITH-TARGET-SSD-SERIAL"'
|
|
|
|
# Optional emergency/validation key baked into root's authorized_keys (blank -> not baked).
|
|
# Leave blank here; bake it only in the uncommitted armed profile if durable break-glass is wanted:
|
|
# FELHOM_ROOT_SSH_KEY="ssh-ed25519 AAAA... ops@felhom"
|